A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Laizhen Li, Xuan Wang, Peicheng Zhao, Juanjuan Zhao, Kejiang Ye, Cheng-zhong Xu, Xitong Gao
cs.CR · cs.AI
Quick verdict
Proposes A2M, a black-box attack that hijacks MCP agents (93.6% invocation, 74.4% ASR on GLM-4.6); convincing, but judge validation and variance lacking.
Summary
The paper introduces A2M, a black-box attack framework that hijacks LLM agents built on the Model Context Protocol (MCP). It formalizes semantic tool-supply-chain attacks as coupled optimization of two objectives: Attraction (crafting tool names and descriptions so agents preferentially invoke a malicious tool) and Manipulation (refining the tool's return payload so post-invocation reasoning follows attacker goals). A2M generates candidates under five persuasion strategies, ranks them via Monte Carlo rollouts, then iteratively refines payloads with an Analyzer-Optimizer loop that diagnoses failures from execution traces. On LiveMCPBench (95 tasks, 70 MCP servers, 527 tools) with a ReAct agent, attacks optimized and evaluated on GLM-4.6 reach a mean malicious tool invocation rate of 93.6% across four scenarios (C-DoS, IE, EIC, RD), inflate weighted token cost to 32.4x under Cognitive Denial of Service, and achieve a mean attack success rate of 74.4% across the three payload attacks, beating Zero-Shot, LLM-GA, AMA and MPMA baselines. Without re-optimization, transfer to Qwen3-Max, DeepSeek-V3.1, Kimi-K2-0905 and GPT-5 yields 63.6% MTIR, 2.7x cost inflation and 24.5% ASR on average. Notably, GPT-5 resists full exploitation (0% ASR on IE/EIC despite 64.9-76.3% MTIR). Main limitations: attack-success scoring relies on an unvalidated DeepSeek-V3 LLM judge, no variance or significance reporting, direct-attack results share tasks with optimization, the ablation covers only C-DoS on 18 tasks, and GPT-5 lacks AMA/MPMA baselines.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- MCP agents' reliance on semantic metadata for tool selection and their trusted treatment of tool returns constitute an exploitable semantic supply-chain channel addressable by two-stage black-box optimization.
- On LiveMCPBench, A2M optimized and evaluated on GLM-4.6 attains a 93.6% mean malicious tool invocation rate, 32.4x weighted C-DoS cost inflation, and 74.4% mean ASR, outperforming Zero-Shot, LLM-GA, AMA and MPMA under matched budgets.
- Optimized tools transfer without re-optimization to four other models at 63.6% MTIR, 2.7x cost inflation, and 24.5% ASR on average, with invocation transferring far more readily than full attack success.
- High invocation does not imply compromise: GPT-5 reaches 64.9-76.3% MTIR yet 0% ASR on Information Exfiltration and Environment Integrity Compromise.
- Evaluated defenses (perplexity detection, LLM auditor, metadata paraphrasing, FIDES-style information-flow control) each reduce but do not eliminate the attack in the tested configuration.
Strengths
Clean problem formalization
Sections 3-4 and Eqs. (3)-(5) decompose semantic tool attacks into coupled Attraction/Manipulation objectives with explicit fitness functions (Eq. 12 weighted tokens for C-DoS; Eq. 13 four-level rubric for IE/EIC/RD); all generator, analyzer, optimizer and judge prompts are disclosed in Appendix C.
Honest invocation-vs-success separation
Reporting MTIR alongside ASR exposes that high invocation does not imply harm: GPT-5 shows 64.9-76.3% MTIR but 0% ASR on IE/EIC (Table 1), and Kimi-K2-0905 pairs 52.6% EIC MTIR with 10.5% ASR - resisting headline-only framing.
Matched-budget baselines and component ablation
Breadth of supporting analyses
Weaknesses
Unvalidated LLM judge determines headline ASR
No statistical treatment anywhere
Direct attacks share the evaluation task set with optimization
Incomplete baseline and ablation coverage
Threat model is stronger than 'black-box' suggests
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
A2M studies agents built on the Model Context Protocol (MCP), where tool choice is driven by semantic metadata and tool outputs enter the reasoning context as trusted environment feedback. The authors formalize a semantic supply-chain threat: an attacker who can register a tool controls its name, description, and return payload (Sec. 3.1-3.2). The core contribution is a two-stage black-box framework - Attraction (maximize selection probability) and Manipulation (maximize post-invocation goal attainment) - motivated by the observation that each objective is useless without the other (Sec. 1, Eqs. 3-5). Headline claims are stated with appropriate configuration precision: on LiveMCPBench (95 tasks, 70 servers, 527 tools), tools optimized and evaluated on GLM-4.6 reach a 93.6% mean malicious tool invocation rate (MTIR) across four scenarios (C-DoS, IE, EIC, RD), a 32.4x weighted token-cost inflation under Cognitive DoS, and a 74.4% mean attack success rate (ASR) across IE/EIC/RD (Table 1); transferred without re-optimization to four other models, means fall to 63.6%, 2.7x, and 24.5%. One framing caveat: the black-box attacker is assumed to locally simulate the victim agent and read full execution traces (Sec. 3.2), a strong capability assumption that deserves emphasis when interpreting practical risk.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the A2M attack on MCP agents?
A2M is a two-stage black-box attack against AI agents that use the Model Context Protocol. It first optimizes a malicious tool's name and description so the agent preferentially selects it among competing tools (Attraction), then iteratively refines the tool's return message using execution traces so the agent follows hidden instructions after invocation (Manipulation). It exploits the fact that MCP agents pick tools by semantic matching and treat tool outputs as trusted environment feedback.
How successful is A2M, and does it work on models it was not optimized for?
Optimized and evaluated on GLM-4.6 over LiveMCPBench, A2M reaches a 93.6% average malicious-tool invocation rate across four attack scenarios, inflates weighted token cost 32.4x under Cognitive Denial of Service, and achieves a 74.4% average attack success rate. Transferred without re-optimization to Qwen3-Max, DeepSeek-V3.1, Kimi-K2-0905 and GPT-5, the averages drop to 63.6%, 2.7x and 24.5%; GPT-5 in particular invokes the malicious tool often but almost never completes the attack (0% success on information exfiltration and environment compromise).
What defenses work against MCP tool-poisoning attacks like A2M?
The paper tests four. GPT-2 perplexity detection is unreliable (33.4% of malicious C-DoS payloads exceed PPL 100, below the benign tools' 43.9%). A Qwen3-8B metadata auditor flags at most 32.5% of cases. Metadata paraphrasing only lowers average invocation rate from 80.7% to 72.5%. FIDES-style information-flow control - treating tool returns as untrusted and sensitive files as confidential - is most effective: on GLM-4.6 it cuts reasoning-derailment success from 92.9% to 11.1%, though 11-23% residual success remains.
Is the A2M code available?
Yes. The paper states code is publicly available at github.com/Lilaizhen/A2M, built on the public LiveMCPBench benchmark (95 tasks, 70 MCP servers, 527 tools). Prompts, hyperparameters, and an estimated optimization cost of $1,192.40 are documented in the appendices.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1-3 are available only as captions/axis text in the extraction; curve shapes in Figure 3 were not directly analyzable.
- Per-scenario task counts are never stated; N of about 41 is inferred from reported percentage granularity (2.4%, 4.9%).
- Full appendices A-G appear included, but table cell alignment may have been lost in extraction; reported means were cross-checked by recomputation from Table 1 and held.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.